Only the latest build on main is supported. Pin a tag for production use.
Report privately — do not open a public issue.
Include: affected check (posture / log scan / drift / rules), how to reproduce, and where the fingerprint logic or threshold fails. Reports about the PHP vulnerabilities themselves belong with the PHP project, not here.
This package intentionally opens no sockets. Findings of the log scan are attempt evidence, not proof of execution; the drift check reads local files only. See "Honest limits" in the README before relying on a verdict.